Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
Detects the creation of a new service using powershell.
Detects the creation of a new service using the "sc.exe" utility.
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Detects the load of known vulnerable drivers via the file name of the drivers.
Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Detects the creation of a new service using powershell.
Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
Detects the load of known vulnerable drivers via their names only.
Detects creation of a new service (kernel driver) with the type "kernel"
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.
Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation
Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
Expanding on DeviceEvents output with Attack Surface Reduction (ASR) rule descriptions.
The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked.
However, it could still be useful to have a more human-friendly description in the results.
Also, this query is a good example for how you could define your own lookup tables and join with them.
The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule.
This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description.
This query shows the ability to use joins and custom dimension tables.
See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
First lets start by creating a table of the rule descriptions to rule guids.
The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked.
However, it could still be useful to have a more human-friendly description in the results.
Also, this query is a good example for how you could define your own lookup tables and join with them.
The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule.
This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description.
This query shows the ability to use joins and custom dimension tables.
See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
First lets start by creating a table of the rule descriptions to rule guids.
Page 35 of 41